Buffer overflow in rsync 2.6.9 to 3.0.1, with extended attribute (xattr) support enabled, might allow remote attackers to execute arbitrary code via unknown vectors.

Sebastian Krahmer of SUSE discovered that rsync could overflow when handling ACLs. An attacker could construct a malicious set of files that, when processed, could lead to arbitrary code execution or a crash (CVE-2008-1720).

The updated packages have been patched to correct this issue.

A remotely exploitable heap overflow in rsync's xattr code has been fixed. CVE-2008-1720 has been assigned to this issue.

The remote host is affected by the vulnerability described in GLSA-200804-16 (rsync: Execution of arbitrary code)

    Sebastian Krahmer of SUSE reported an integer overflow in the     expand_item_list() function in the file util.c which might lead to a     heap-based buffer overflow when extended attribute (xattr) support is     enabled.
  Impact :

    A remote attacker could send a file containing specially crafted     extended attributes to an rsync deamon, or entice a user to sync from     an rsync server containing specially crafted files, possibly leading to     the execution of arbitrary code.
    Please note that extended attributes are only enabled when USE='acl' is     enabled, which is the default setting.
  Workaround :

    Disable extended attributes in the rsync daemon by setting 'refuse     options = xattrs' in the file '/etc/rsyncd.conf' (or append     'xattrs' to an existing 'refuse' statement). When synchronizing to a     server, do not provide the '-X' parameter to rsync. You can also     disable the 'acl' USE flag for rsync and recompile the package.

- Tue Apr 8 2008 Simo Sorce <ssorce at redhat.com>     2.6.9-6.fc7

    - Security release:
      http://rsync.samba.org/security.html#s3_0_2

    - Wed Sep 5 2007 Simo Sorce <ssorce at redhat.com>       2.6.9-3.fc7

    - Add patch to fix crash bug with hardlinks and ACLs       patches

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Apr 8 2008 Simo Sorce <ssorce at redhat.com>     2.6.9-5.fc8

    - Security release:
      http://rsync.samba.org/security.html#s3_0_2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastian Krahmer discovered that rsync could overflow when handling ACLs. An attacker could construct a malicious set of files that when processed by rsync could lead to arbitrary code execution or a crash.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sebastian Krahmer discovered that an integer overflow in rsync's code for handling extended attributes may lead to arbitrary code execution.

ID	Name	Product	Family	Severity
36629	Mandriva Linux Security Advisory : rsync (MDVSA-2008:084)	Nessus	Mandriva Local Security Checks	high
32120	openSUSE 10 Security Update : rsync (rsync-5207)	Nessus	SuSE Local Security Checks	high
32009	GLSA-200804-16 : rsync: Execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
31974	Fedora 7 : rsync-2.6.9-6.fc7 (2008-3060)	Nessus	Fedora Local Security Checks	high
31972	Fedora 8 : rsync-2.6.9-5.fc8 (2008-3047)	Nessus	Fedora Local Security Checks	high
31966	Ubuntu 7.04 / 7.10 : rsync vulnerability (USN-600-1)	Nessus	Ubuntu Local Security Checks	high
31951	Debian DSA-1545-1 : rsync - integer overflow	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2008-1720

critical

Tenable Plugins

high

high

high

high

high

high

high